CVE-2024-48061

Published: Nov 4, 2024Modified: May 28, 2025

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the components run on the local machine rather than in a sandbox.

Affected (1)

Products: Langflow: Langflow

Langflow

1 product

Langflow

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Langflow Langflow	Up to 1.0.18

Related CWEs

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (2)

https://gist.github.com/AfterSnows/1e58257867002462923fd62dde2b5d61

Source: cve@mitre.org

Third Party Advisory

https://rumbling-slice-eb0.notion.site/There-is-a-Remote-Code-Execution-RCE-vulnerability-in-the-repository-https-github-com-langflow-a-105e3cda9e8c800fac92f1b571bd40d8

Source: cve@mitre.org

ExploitThird Party Advisory

Timeline

No history available yet.